Authorised scams
The customer pressed send
In an authorised push payment scam, the customer passes every authentication check. The warning signs sit in the payee, the amount and the pattern. The login looks normal.
BetaThreat squad
Leo Payden — Director AI Payment Security
AI payment security before the money settles
Leo Payden — Director AI Payment SecurityLeo Payden is an AI agent that watches card, account and instant payments and screens them in flight, before settlement. He scores each payment, explains the risk and holds it for review if you set him to. He also keeps evidence for your PCI DSS controls. Your payments and fraud teams make the call.
Leo Payden
Instant payment #IP-60431 screened
IllustrativeHeld for review
Risk score 0.77 · high
Flag explained
“First payment to a new payee, payee account recently opened, amount near daily limit.”
Job description
What Leo Payden does Job description
Leo Payden is a Director AI Payment Security. He sits in your payment flow across cards, accounts and instant rails, screens payments before settlement and prepares the evidence your team reviews.
AI AGENT · THREAT SQUADBeta
LEO PAYDEN
Director AI Payment Security
REPORTS TO
Your Head of Payments Risk or Head of Fraud
WORKS WITH
Your payment gateway, card processor, core banking and instant payment connections
DEPLOYED
Shadow mode first, then the autonomy you set
KEY RESPONSIBILITIES
01Screen card, account and instant payments in flight, before settlement, on one view of the customer
02Score scam and fraud risk on payee, amount, device, behaviour and payment history
03Hold high-risk payments for review if you set him to, and send them to an analyst with the evidence attached
04Check originator and beneficiary information on transfers against your screening rules
05Keep evidence for your PCI DSS controls, such as access to payment data and monitoring logs
AUTONOMY MODEL
LOWMEDIUMHIGH
Low risk
Clear low-risk payments continue with a recorded reason, if you allow it
Medium risk
Goes to an analyst by default
High risk
Always goes to an analyst
You set the threshold per rule.
Kill switch: Turn Leo off at any time
Options
How the options compare
| CRITERIA | Processor and scheme tools | Rules engine per rail | Leo Payden |
|---|---|---|---|
| Time to first results | Already in place | Rule build per rail | Shadow mode on your live payment flow |
| Who decides | Vendor score, then analyst | Rule threshold, then analyst | Analyst, inside autonomy bands you set |
| View across rails | One rail only | One rail per engine | Cards, accounts and instant payments together |
| Why a payment was held | Vendor reason code | Rule ID | Plain-English reason with the signals behind it |
| Authorised scam signals | Limited | Only where a rule exists | Payee, amount and pattern scored on each payment |
| Where it's weaker | Can't see the rest of the customer | Static thresholds miss new scams | Screening in flight adds a step to the payment path; you test the latency on your rails in shadow mode |
Works best with
AI agents that work best with Leo Payden
Leo's screening gets sharper when other agents add what he can't see in the payment itself.
THREAT
Aiden Flux
Senior AI Fraud Risk Analyst
Brings monitoring alerts and the customer's behaviour baseline into Leo's score.
Meet AidenTRUST AND IDENTITY
Nova Sentinel
Lead AI Zero Trust Security Architect
Settles session and device trust before the payment reaches Leo.
Meet NovaTHREAT
Piers Openfield
Senior AI Open Banking Specialist
Flags risky third-party providers initiating payments through open banking.
Meet Piers
Thoughts that matter
Insights on AI agents, financial crime and compliance
What we're learning about AML, fraud and the evidence examiners ask for.
Best AML Software in 2026: An Honest Comparison for Banks and Fintechs
Read More
goAML Registration and STR Filing in the UAE: A Step-by-Step Guide for Reporting Entities
Read More
Transaction Monitoring Software: UAE Acceptance Checklist
Read More
PEP and Sanctions Screening: What the MLRO Owns
Read More
Session Risk Scoring: Continuous Authentication for Banks
Read More
Impossible Travel Detection in Banking: How It Works
Read More
Questions? We Have Answers
-1.svg)
Frequently Asked Questions
Still have questions?
Talk to the people who build the agents. We'll answer per capability, yes or no.
It screens payments as they move, before settlement, for fraud and scam risk. Leo Payden scores card, account and instant payments on one view of the customer, explains each score and holds high-risk payments for review if you set him to. Your analysts make the call.
Only if you set him to hold them, and a held payment goes to an analyst. Medium risk goes to a person by default and high risk always does. Low-risk payments continue without a person only where you allow it. A kill switch turns Leo off without touching your payment rails.
He looks for the signs that come with them: a new payee, an unusual amount, a recently opened receiving account and changes in the customer's behaviour. Authentication alone can't catch these, because the customer authorises the payment.
Any check in the payment path adds some time. You measure it on your rails and volumes during shadow mode, and you choose which payments Leo screens before settlement.
We don't claim PCI DSS certification. Leo keeps evidence for the controls you align to under PCI DSS v4.0.1, such as monitoring and access to payment data. Your assessor reviews it as part of your assessment.
Leo scores a copy of your live payment flow, but nothing is held or released. You compare his calls with your current controls and with confirmed fraud. You decide whether, and where, to switch on any autonomy afterwards.
FluxForce runs as SaaS, on-premise or hybrid, built on Microsoft Azure. We agree data residency and which components run inside your environment during deployment design, before any data moves.